Analysis
-
max time kernel
299s -
max time network
252s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 20:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.assetboxes.com/c/18377/images/DSpng168441732064662b284fb01181840570.png
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://cdn.assetboxes.com/c/18377/images/DSpng168441732064662b284fb01181840570.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597586183946432" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 776 chrome.exe 776 chrome.exe 3460 chrome.exe 3460 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 776 chrome.exe 776 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe Token: SeShutdownPrivilege 776 chrome.exe Token: SeCreatePagefilePrivilege 776 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe 776 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 776 wrote to memory of 1640 776 chrome.exe 89 PID 776 wrote to memory of 1640 776 chrome.exe 89 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 3020 776 chrome.exe 91 PID 776 wrote to memory of 1372 776 chrome.exe 92 PID 776 wrote to memory of 1372 776 chrome.exe 92 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93 PID 776 wrote to memory of 396 776 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.assetboxes.com/c/18377/images/DSpng168441732064662b284fb01181840570.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccc6fab58,0x7ffccc6fab68,0x7ffccc6fab782⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:22⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:82⤵PID:1372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:82⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:12⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2204 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:12⤵PID:3612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4256 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:82⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:82⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1920,i,420019026846099221,3307378938011322664,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3460
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:81⤵PID:3256
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56daae8b00e92b85a2af3446c80d62f57
SHA1127c792661cdea221a5320fab0cd03e9abe6f804
SHA2567760477d28105bd17bbf7ac48fbafe16d92b4a7b9d761d7d8ec4d355493730ec
SHA512050e04e6a2a12e3ed055885e2f75d4960e11c7d9a0585c6e38f39365115555c6a629769524bf76dd7c98a99286ef9d32a96ee7b149ebc85c0a5a8674c7a75140
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
523B
MD59d96adef70825298f591d282185371b1
SHA16f2b0892f63acec6bebb60d0639367fa3ba342cd
SHA2561c8979dc6d0c6ddff3c44f21f76f39c5f8ea5293a6c499a0d18e056e79234aed
SHA512a2d1c8a99d8fe352b025c3c3319d381cdb01cb032e32a8ca836325cafe6093304d6b6a2792eb7ce34d5708c2976dda8163b8a47b12e17f58c2e3008d53a8f2c2
-
Filesize
7KB
MD51cd8d7b1d22b2fca44b1a9f64b54271a
SHA19e655bd9e02d6c21f50a03c565a40868d7689bd0
SHA2561687f0d80719915ec018b232b38703eb6bf1994f867fa53fe0d76c3aa9ebfaf9
SHA512fc4e7c7acfb4fd3cb4a143f0eec60d1926a68a2535dfed5bf0ccc970a2991312c6df8d6c55eaca91267570d4134283ba4418cf2ac3c0459a23ad9d60d4441758
-
Filesize
255KB
MD517663c431e083455a3ae4c331aae06a6
SHA1b1f5f1ae2469f6c185c871871865c4491121cbbe
SHA256032f8d4335e318f50b2c9e56a7255333b3fcf0ec5b41ca95ee4665b3318dd954
SHA5127109bf965713b52ca73a6ec7c1af2285b4762706997453f6ca81ce3d8cbac207f1581e66f443a62bc4b52282878223eed3c0b76575387c0da90c39b1a8f0c27d